RBAC Identity Abstraction for Multi-Tenant Scalability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Role-based access control (RBAC) systems face scalability issues in large multi-tenanted or cloud-based computing environments, where managing hundreds of thousands of role assignments and revalidations becomes resource-intensive and inefficient.
Innovation Solution
Abstracting individual users into a service provider identity dataset, allowing the service provider to apply for roles on behalf of users, and periodically revalidating these roles, reducing the need for individual user revalidation and simplifying management processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If individual user roles are managed in traditional RBAC systems, then access control precision is improved, but system complexity and resource consumption increase significantly in multi-tenanted environments
Solution Approach 1:
The patent merges multiple individual user identities into a unified service provider identity dataset. This consolidation allows the system to manage access control at the service provider level rather than individual user level, reducing the number of role assignments from hundreds of thousands to a manageable quantity while maintaining security through periodic revalidation of the aggregated identity dataset
Solution Approach 2:
The service provider identity dataset acts as an intermediary layer between individual users and the RBAC system. This intermediary aggregates user identities and presents a unified front for role assignment, simplifying the interaction with the access control system while preserving the ability to manage individual user access through the service provider's consolidated identity
2Reliability
If every user's individual authorizations are managed in multi-tenant systems, then access control accuracy is improved, but resource consumption and management time increase excessively
Solution Approach 1:
The patent combines multiple individual user authorizations into a single service provider identity dataset, reducing the management overhead from handling hundreds of thousands of individual user roles to managing a consolidated identity representation, thereby dramatically improving management efficiency while preserving access control accuracy
Solution Approach 2:
The system implements periodic revalidation of the service provider identity dataset's addition to the role dataset. This periodic action ensures access control accuracy is maintained over time without requiring continuous individual user verification, balancing security requirements with management efficiency
3Reliability
If individual user revalidation is performed frequently, then security is improved, but time consumption and administrative burden increase significantly
Solution Approach 1:
By merging individual user identities into a service provider identity dataset, the system reduces the number of revalidation operations required. Instead of validating hundreds of thousands of individual user roles, the system performs periodic revalidation on the consolidated identity dataset, significantly reducing time consumption while maintaining security
Solution Approach 2:
The patent implements periodic revalidation of the service provider identity dataset rather than continuous individual user revalidation. This periodic approach maintains security by regularly verifying access rights while minimizing administrative burden and time consumption compared to frequent individual user validation
Data Source
AI summary
A method and system for improving efficiency and security of a role based access control (RBAC) identity management system. A service provider owner requests an addition of a service provider identity dataset to a role dataset in the RBAC identity management system. The role dataset includes permissions to the individual users within the service provider identity dataset to access a secured resource of the RBAC identity management system and to perform the service on the secured resource. Addition of the service provider identity dataset to the role dataset is granted and is periodically revalidated which includes receiving an instruction to maintain or delete the service provider identity dataset from the role dataset. Access to the secured resource is based on the service provider identity dataset in the role dataset, instead of being based on the individual users, which improves the efficiency and security of the RBAC identity management system.